使用Terraform创建带私有端点的Azure PostgreSQL弹性服务器报错

问题根源 #

你在配置azurerm_postgresql_flexible_server时已指定delegated_subnet_id和private_dns_zone_id，这会触发Azure的VNet集成模式——服务器直接部署到指定子网并自动完成私有DNS解析配置。此时手动创建独立的azurerm_private_endpoint属于重复操作，两种网络接入方式互斥，导致报错。

修正方案 #

1. 删除冗余资源：移除Terraform脚本中手动创建的azurerm_private_endpoint.postgres_private_endpoint资源块。
2. 修正子网委托权限：确保子网对Microsoft.DBforPostgreSQL/flexibleServers的委托包含完整必要操作，避免权限不足：

   service_delegation {
     name = "Microsoft.DBforPostgreSQL/flexibleServers"
     actions = [
       "Microsoft.Network/virtualNetworks/subnets/join/action",
       "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
       "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"
     ]
   }
   

3. 保留必要的DNS关联：继续使用azurerm_private_dns_zone_virtual_network_link确保私有DNS区域与VNet绑定，实现内部域名解析。

修正后的PostgreSQL核心配置示例 #

resource "azurerm_private_dns_zone" "postgres_dns_zone" {
  name                = "${var.project_name}${var.environment}.postgres.database.azure.com"
  resource_group_name = var.resource_group
  tags                = var.tags
}

resource "azurerm_postgresql_flexible_server" "db" {
  name                          = "${var.project_name}${var.environment}postgres"
  resource_group_name           = var.resource_group
  location                      = var.location
  administrator_login           = var.db_admin
  administrator_password        = random_password.postgres_password.result
  sku_name                      = var.db_sku
  zone                          = var.zone
  version                       = var.db_version
  delegated_subnet_id           = var.subnet_id
  private_dns_zone_id           = azurerm_private_dns_zone.postgres_dns_zone.id
  storage_mb                    = var.db_storage
  backup_retention_days         = 7
  geo_redundant_backup_enabled  = false
  public_network_access_enabled = false
  dynamic "high_availability" {
    for_each = var.enable_ha ? [1] : []
    content {
      mode                     = "ZoneRedundant"
      standby_availability_zone = var.ha_zone
    }
  }

  depends_on                    = [azurerm_private_dns_zone.postgres_dns_zone]
  tags                          = var.tags
}

resource "azurerm_postgresql_flexible_server_configuration" "postgis" {
  name      = "azure.extensions"
  server_id = azurerm_postgresql_flexible_server.db.id
  value     = "POSTGIS"
}

resource "azurerm_private_dns_zone_virtual_network_link" "pg_dns_vnet_link" {
  name                  = "${azurerm_postgresql_flexible_server.db.name}-vnetlink"
  resource_group_name   = var.resource_group
  private_dns_zone_name = azurerm_private_dns_zone.postgres_dns_zone.name
  virtual_network_id    = var.vnet_id
  tags                  = var.tags
  depends_on            = [azurerm_postgresql_flexible_server.db]
}

验证步骤 #

• 部署完成后，检查PostgreSQL服务器的网络配置，确认显示为私有访问（VNet集成）
• 在VNet内的虚拟机上，通过服务器私有域名尝试连接数据库，验证连通性
• 查看私有DNS区域的记录，确认已自动生成服务器的A记录

内容的提问来源于stack exchange，提问作者Jonty